--- name: "gnunet.conf" section: "5" platform: "linux" package: "gnunet" version: "0.20.0-7" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/gnunet.conf" --- # gnunet.conf(5) GNUnet configuration file ## NAME **gnunet.conf** – GNUnet configuration file ## DESCRIPTION A GNUnet setup typically consists of a set of service processes run by a user "gnunet" and a set of user-interface processes run by a standard account. The default location for the configuration file for the services is *~gnunet/.config/gnunet.conf*. However, as normal users also may need read-access to this configuration, you might want to instead put the service process configuration in */etc/gnunet.conf*. [gnunet-setup(1)](/gnunet-setup/1.md), part of gnunet-gtk, can be used to edit this configuration. The parts of GNUnet that are run as a normal user may have config options too and they read from *$HOME/.config/gnunet.conf*. The latter config file can skip any options for the services. The basic structure of the configuration file is the following. - The file is split into sections. - Every section begins with a token in square brakets. The current section ends when a new section starts or end of file is encountered. - A section contains a number of options of the form "OPTION=VALUE". - Whitespace surrounding the "=" token is striped out, in other words "OPTION = VALUE" and "OPTION=VALUE" are treated equal. - Empty lines and lines beginning with a "#" are treated as comments. - Boolean values are given as "YES" and "NO". Almost all options are optional. The tools resort to reasonable defaults if an option is not present. Default values for all of the options can be found in the files in the *$GNUNET\_PREFIX/share/gnunet/config.d/* directory. A typical setup will work out of the box with those. See the examples section below for some common setups on top of that. ### Variable naming conventions and data types Boolean values for options are set via "YES" or "NO" values, without the double-quotes. Options which include "PATH" or "path" define a path on the file-system and can take additional variables in the path, such as $GNUNET\_TMP. Section names as listed more in detail below, are small letters only enclosed by square brakets. ### GENERAL OPTIONS Many options will be common between sections. They can be repeated under each section with different values. The "\[PATHS\]" section is special. Here, it is possible to specify values for variables like "GNUNET\_HOME". Then, in all filenames that begin with "$GNUNET\_HOME" the "$GNUNET\_HOME" will be replaced with the respective value at runtime. The main use of this is to redefine "$GNUNET\_HOME", which by default points to *$HOME/.config/*. By setting this variable, you can change the location where GNUnet stores its internal data. *gnunet.conf* accepts the variable GNUNET\_TMP which we suggest to use in place of the absolute definition of */tmp*. So instead of */tmp/foo* you would write *$GNUNET\_TMP/foo*. The usage of *$GNUNET\_TMP/foo*, will result in *$TMPDIR/gnunet/foo*, or *$TMP/gnunet/foo* and finally, if TMPDIR is undefined, */tmp/gnunet/foo*. The following options are generic and shared by all services: - HOSTNAME The hostname specifies the machine on which the service is running. This is usually "localhost". - BINARY The filename that implements the service. For example "gnunet-service-ats". - IMMEDIATE\_START Start the service always when the peer starts. Set to YES for services that should always be launched, even if no other service explicitly needs them. - START\_ON\_DEMAND Set to YES to automatically start the service when it is requested by another service. YES for most GNUnet services. - NOARMBIND Set to YES to never have ARM bind to the respective socket. This option is mostly for debugging in situations where ARM cannot pass the pre-bound socket to the child due to interference from PREFIX-commands. This option is only effective in combination with IMMEDIATE\_START being YES. NO by default. - PREFIX PREFIX the given command (with its arguments) to the actual BINARY to be executed. Useful to run certain services under special supervisors like strace, dtrace, or valgrind. Typically used in combination with IMMEDIATE\_START and NOARMBIND. Empty by default. - ACCEPT\_FROM A semi-column separated list of IPv4 addresses that are allowed to use the service; usually 127.0.0.1. - ACCEPT\_FROM6 A semi-column separated list of IPv6 addresses that are allowed to use the service; usually ::1. - UNIXPATH Path to use for the UNIX domain socket for inter process communication with the service on POSIX systems. - UNIX\_MATCH\_UID If UNIX domain sockets are used, set this to YES if only users with the same UID are allowed to access the service. - UNIX\_MATCH\_GID If UNIX domain sockets are used, set this to YES if only users with the same GID are allowed to access the service. - RUN\_PER\_USER End-users should never have to change the defaults GNUnet provides for this option. - YES Set to YES if this service should be run per-user. - NO Set to NO if this is a system service. In the following sections the absence of a default value is either expressed as "Default value:" followed by nothing, or the lack of this line. ### ARM - PORT Default value: 2087 - HOSTNAME Default value: localhost - BINARY Default value: gnunet-service-arm - ACCEPT\_FROM Default value: 127.0.0.1; - ACCEPT\_FROM6 Default value: ::1; - UNIXPATH Special case, uses user runtime dir even for per-system service. Default value: $GNUNET\_USER\_RUNTIME\_DIR/gnunet-service-arm.sock - UNIX\_MATCH\_UID Default value: YES - UNIX\_MATCH\_GID Default value: YES - GLOBAL\_POSTFIX In the **-l** option, format characters from [strftime(3)](/strftime/3.md) are allowed; In the GLOBAL\_POSTFIX, "{}" stands for the name of the respective service. Thus the following example for this option would introduce per-service logging with a new log file each day. Note that only the last 3 log files are preserved. Example: \-l $GNUNET\_CACHE\_HOME/{}-%Y-%m-%d.log Default value: - GLOBAL\_PREFIX Default value: - START\_SYSTEM\_SERVICES If set to YES, ARM will only start services that are marked as system-level services (and we'll expect a second ARM to be run per-user to run user-level services). Note that in this case you must have manually created a different configuration file with the user where at least this and the START\_USER\_SERVICES options differ. - START\_USER\_SERVICES If set to YES, ARM will only start services that are marked as per-user services (and we'll expect a system user to run ARM to provide system-level services). Per-user services enable better personalization and privilege separation and in particular ensures that personal data is stored under $HOME, which might be important in a multi-user system (or if $HOME is encrypted and */var/* is not). Note that if you have different ARM services for SYSTEM and USER, and you are not on UNIX, you need to change the PORT option for the USER ARM instances to some free port (counting down from 2085 should provide free ports). - RESOURCE\_DIAGNOSTICS File where we should log per-service resource consumption on exit. Default value: resource.log - USERNAME Name of the user that will be used to provide the service. Default value: - MAXBUF Default value: - TIMEOUT Default value: - DISABLEV6 Default value: - BINDTO Default value: - REJECT\_FROM Default value: - REJECT\_FROM6 Default value: - PREFIX Default value: ### ATS - PORT Default value: 2098 - HOSTNAME Default value: localhost - BINARY Default value: gnunet-service-ats - ACCEPT\_FROM Default value: 127.0.0.1; - ACCEPT\_FROM6 Default value: ::1; - UNIXPATH Default value: $GNUNET\_RUNTIME\_DIR/gnunet-service-ats.sock - UNIX\_MATCH\_UID Default value: NO - UNIX\_MATCH\_GID Default value: YES - MODE Designated assignment mode. Possible values: PROPORTIONAL, MLP, RIL. Default value: proportional - UNSPECIFIED\_QUOTA\_IN quotes in KiB or MiB per seconds. Or use the word "unlimited". Default value: 64 KiB - UNSPECIFIED\_QUOTA\_OUT quotes in KiB or MiB per seconds. Or use the word "unlimited". Default value: 64 KiB - LOOPBACK\_QUOTA\_IN quotes in KiB or MiB per seconds. Or use the word "unlimited". Default value: unlimited - LOOPBACK\_QUOTA\_OUT quotes in KiB or MiB per seconds. Or use the word "unlimited". Default value: unlimited - LAN\_QUOTA\_IN quotes in KiB or MiB per seconds. Or use the word "unlimited". Default value: unlimited - LAN\_QUOTA\_OUT quotes in KiB or MiB per seconds. Or use the word "unlimited". Default value: unlimited - WAN\_QUOTA\_IN quotes in KiB or MiB per seconds. Or use the word "unlimited". Default value: 64 KiB - WAN\_QUOTA\_OUT quotes in KiB or MiB per seconds. Or use the word "unlimited". Default value: 64 KiB - WLAN\_QUOTA\_IN quotes in KiB or MiB per seconds. Or use the word "unlimited". Default value: 1 MiB - WLAN\_QUOTA\_OUT quotes in KiB or MiB per seconds. Or use the word "unlimited". Default value: 1 MiB - BLUETOOTH\_QUOTA\_IN Default value: 128 KiB - BLUETOOTH\_QUOTA\_OUT Default value: 128 KiB - PROP\_PROPORTIONALITY\_FACTOR How proportional to preferences is bandwidth distribution in a network? Default value: 2.00 - 1\.0 Fair with respect to addresses without preferences. - \> 1.0 The bigger, the more respect is paid to preferences. - PROP\_STABILITY\_FACTOR Should we stick to existing connections are prefer to switch? \[1.0...2.0\], lower value prefers to switch, bigger value is more tolerant. Default value: 1.25 - MLP\_MAX\_DURATION Maximum duration for a solution process (both LP and MILP). Default value: 3 s - MLP\_MAX\_ITERATIONS Maximum numbero of iterations for a solution process (only LP). Tolerated MIP Gap \[0.0 .. 1.0\]. Default value: 0.025 - MLP\_MAX\_MIP\_GAP Tolerated LP/MIP Gap \[0.0 .. 1.0\]. Default value: 0.025 - MLP\_MAX\_LP\_MIP\_GAP Default value: 0.025 - MLP\_MAX\_ITERATIONS Maximum number of iterations for a solution process. Default value: 1024 - MLP\_COEFFICIENT\_D Default value: 1.0 - MLP\_COEFFICIENT\_U Default value: 1.0 - MLP\_COEFFICIENT\_R Default value: 1.0 - MLP\_MIN\_BANDWIDTH Default value: 1024 - MLP\_MIN\_CONNECTIONS Default value: 4 - MLP\_DUMP\_PROBLEM\_ALL Dump all problems to disk. Default value: YES - MLP\_DUMP\_SOLUTION\_ALL Dump all solution to disk. Default value: YES - MLP\_GLPK\_VERBOSE Print GLPK output. Default value: YES - MLP\_DUMP\_PROBLEM\_ON\_FAIL Dump all problems to disk. Default value: YES - MLP\_DUMP\_SOLUTION\_ON\_FAIL Dump all solution to disk. Default value: YES - RIL\_STEP\_TIME\_MIN Default value: 500 ms - RIL\_STEP\_TIME\_MAX Default value: 1000 ms - RIL\_ALGORITHM Possible values: SARSA or Q-LEARNING. Default value: Q-LEARNING - RIL\_DISCOUNT\_BETA Default value: 0.7 - RIL\_GRADIENT\_STEP\_SIZE Default value: 0.3 - RIL\_TRACE\_DECAY Default value: 0.2 - RIL\_EXPLORE\_RATIO Default value: 0.1 - RIL\_GLOBAL\_REWARD\_SHARE Default value: 1 ### AUCTION ### CADET - IMMEDIATE\_START Default value: YES - START\_ON\_DEMAND Default value: YES - PORT Default value: 2096 - HOSTNAME Default value: localhost - BINARY Default value: gnunet-service-cadet - PREFIX - ACCEPT\_FROM Default value: 127.0.0.1; - ACCEPT\_FROM6 Default value: ::1; - UNIXPATH Default value: $GNUNET\_RUNTIME\_DIR/gnunet-service-cadet.sock - UNIX\_MATCH\_UID Default value: NO - UNIX\_MATCH\_GID Default value: YES - REFRESH\_CONNECTION\_TIME How often do we send KEEPALIVE messages on connections to keep them from timing out? Default value: 5 min - DROP\_PERCENT Percentage of packets CADET is artificially dropping. Used for testing only! - ID\_ANNOUNCE\_TIME How frequently do we usually announce our presence in the DHT? Default value: 1 h - CONNECT\_TIMEOUT Default value: 30 s - DHT\_REPLICATION\_LEVEL What is the replication level we give to the DHT when announcing our existence? Usually there is no need to change this. Default value: 3 - MAX\_TUNNELS Not implemented Default value: 1000 - MAX\_CONNECTIONS Not implemented, replaced by MAX\_ROUTES in NEW CADET! Default value: 1000 - MAX\_ROUTES How many routes do we participate in at most? Should be smaller than MAX\_MSGS\_QUEUE. Default value: 5000 - MAX\_MSGS\_QUEUE Not implemented Default value: 10000 - MAX\_PEERS Not implemented Default value: 1000 - RATCHET\_TIME How often do we advance the ratchet even if there is not any traffic? Default value: 1 h - RATCHET\_MESSAGES How often do we advance the ratched if there is traffic? Default value: 64 ### COMMUNICATOR-UNIX - UNIXPATH Default value: $GNUNET\_RUNTIME\_DIR/gnunet-communicator-unix.sock ### CONSENSUS - START\_ON\_DEMAND Default value: YES - PORT Default value: 2103 - HOSTNAME Default value: localhost - BINARY Default value: gnunet-service-consensus - ACCEPT\_FROM Default value: 127.0.0.1; - ACCEPT\_FROM6 Default value: ::1; - UNIXPATH Default value: $GNUNET\_RUNTIME\_DIR/gnunet-service-consensus.sock - UNIX\_MATCH\_UID Default value: YES - UNIX\_MATCH\_GID Default value: YES ### CORE - START\_ON\_DEMAND Default value: YES - PORT Default value: 2092 - HOSTNAME Default value: localhost - BINARY Default value: gnunet-service-core - ACCEPT\_FROM Default value: 127.0.0.1; - ACCEPT\_FROM6 Default value: ::1; - UNIXPATH Default value: $GNUNET\_RUNTIME\_DIR/gnunet-service-core.sock - UNIX\_MATCH\_UID Default value: NO - UNIX\_MATCH\_GID Default value: YES - DISABLE\_SOCKET\_FORWARDING Default value: NO - USERNAME - MAXBUF - TIMEOUT - DISABLEV6 - BINDTO - REJECT\_FROM - REJECT\_FROM6 - PREFIX - USE\_EPHEMERAL\_KEYS Default value: YES This MUST be set to YES in production, only set to NO for testing for performance (testbed/cluster-scale use!). ### DATACACHE-POSTGRES - CONFIG Default value: postgres:///gnunet ### DATASTORE - START\_ON\_DEMAND Default value: YES - UNIXPATH Default value: $GNUNET\_RUNTIME\_DIR/gnunet-service-datastore.sock - UNIX\_MATCH\_UID Default value: NO - UNIX\_MATCH\_GID Default value: YES - PORT Default value: 2093 - HOSTNAME Default value: localhost - BINARY Default value: gnunet-service-datastore - ACCEPT\_FROM Default value: 127.0.0.1; - ACCEPT\_FROM6 Default value: ::1; - QUOTA Default value: 5 GB - BLOOMFILTER Default value: $GNUNET\_DATA\_HOME/datastore/bloomfilter - DATABASE Default value: sqlite - DISABLE\_SOCKET\_FORWARDING Default value: NO ### DATASTORE-SQLITE - FILENAME Default value: $GNUNET\_DATA\_HOME/datastore/sqlite.db ### DATASTORE-POSTGRES - CONFIG Default value: postgres:///gnunet ### DATASTORE-MYSQL - DATABASE Default value: gnunet - CONFIG Default value: ~/.my.cnf - USER Default value: gnunet - PASSWORD - HOST Default value: localhost - PORT Default value: 3306 ### DATASTORE-HEAP - HASHMAPSIZE Default value: 1024 ### DHT - IMMEDIATE\_START *boolean* Default value: YES - START\_ON\_DEMAND *boolean* Default value: YES - PORT *integer* Default value: 2095 - HOSTNAME *string* Default value: localhost - BINARY *string* Default value: gnunet-service-dht - ACCEPT\_FROM *string* Default value: 127.0.0.1; - ACCEPT\_FROM6 *string* Default value: ::1; - BUCKET\_SIZE *integer* Default value: 4 - UNIXPATH *path* Default value: $GNUNET\_RUNTIME\_DIR/gnunet-service-dht.sock - UNIX\_MATCH\_UID *boolean* Default value: NO - UNIX\_MATCH\_GID *boolean* Default value: YES - DISABLE\_SOCKET\_FORWARDING *boolean* Default value: NO - USERNAME = - MAXBUF = - TIMEOUT = - DISABLEV6 = - BINDTO = - REJECT\_FROM = - REJECT\_FROM6 = - PREFIX = - \# Should the DHT cache results that we are routing in the DATACACHE as well? CACHE\_RESULTS = YES - \# Special option to disable DHT calling 'try\_connect' (for testing) DISABLE\_TRY\_CONNECT = NO ### DHTCACHE - DATABASE Default value: heap - QUOTA Default value: 50 MB - DISABLE\_BF\_RC *boolean* Disable RC-file for Bloom filter? (for benchmarking with limited IO availability) Default value: NO ### EXIT ### FS ### GNS ### HOSTLIST ### IDENTITY ### NAMECACHE ### NAMESTORE ### NAT-AUTO ### NAT ### NSE ### PEERINFO ### PEERSTORE ### PT ### REGEX ### RESOLVER ### REST - UNIXPATH Default value: $GNUNET\_USER\_RUNTIME\_DIR/gnunet-service-rest.sock - BINARY Default value: gnunet-rest-server - BIND\_TO Default value: 127.0.0.1 - BIND\_TO6 Default value: ::1 - REST\_PORT Default value: 7776 - REST\_ALLOW\_HEADERS Default value: Authorization,Accept,Content-Type - REST\_ALLOW\_ORIGIN Default value: \* - REST\_ALLOW\_CREDENTIALS Default value: true ### REVOCATION ### SCALARPRODUCT ### SECRETSHARING ### SET ### STATISTICS ### TEMPLATE ### TESTBED-LOGGER ### TESTBED ### TESTING ### TOPOLOGY - IMMEDIATE\_START Default value: YES - NOARMBIND Default value: YES - MINIMUM-FRIENDS Default value: 0 - FRIENDS-ONLY Default value: NO - TARGET-CONNECTION-COUNT Default value: 16 - FRIENDS Default value: $GNUNET\_CONFIG\_HOME/topology/friends.txt - BINARY Default value: gnunet-daemon-topology ### TRANSPORT ### UTIL ### VPN - START\_ON\_DEMAND Default value: YES - PORT Default value: 2105 - HOSTNAME Default value: localhost - BINARY Default value: gnunet-service-vpn - ACCEPT\_FROM Default value: 127.0.0.1; - ACCEPT\_FROM6 Default value: ::1; - UNIXPATH Default value: $GNUNET\_RUNTIME\_DIR/gnunet-service-vpn.sock - UNIX\_MATCH\_UID Default value: NO - UNIX\_MATCH\_GID Default value: YES - IPV6ADDR Default value: 1234::1 - IPV6PREFIX Default value: 32 - IPV4ADDR Default value: 10.11.10.1 - IPV4MASK Default value: 255.255.0.0 - VIRTDNS Default value: 10.11.10.2 - VIRTDNS6 Default value: 1234::17 - IFNAME Default value: vpn-gnunet ### ZONEMASTER - START\_ON\_DEMAND Default value: YES - IMMEDIATE\_START Default value: YES - HOSTNAME Default value: localhost - BINARY Default value: gnunet-service-zonemaster - UNIXPATH Default value: $GNUNET\_USER\_RUNTIME\_DIR/gnunet-service-zonemaster.sock - PORT Default value: 2123 - UNIX\_MATCH\_UID Do we require users that want to access GNS to run this process (usually not a good idea)? Default value: NO - UNIX\_MATCH\_GID Do we require users that want to access GNS to be in the 'gnunet' group? Default value: NO - MAX\_PARALLEL\_BACKGROUND\_QUERIES How many queries is GNS allowed to perform in the background at the same time? Default value: 1000 - ZONE\_PUBLISH\_TIME\_WINDOW How frequently do we try to publish our full zone? Default value: 4 h - USE\_CACHE Using caching or always ask DHT? Default value: YES - PREFIX ### ZONEMASTER-MONITOR - START\_ON\_DEMAND Default value: YES - IMMEDIATE\_START Default value: YES - HOSTNAME Default value: localhost - BINARY Default value: gnunet-service-zonemaster-monitor - UNIXPATH Default value: $GNUNET\_USER\_RUNTIME\_DIR/gnunet-service-zonemaster-monitor.sock - PORT Default value: 2124 - UNIX\_MATCH\_UID Do we require users that want to access GNS to run this process (usually not a good idea)? Default value: NO - UNIX\_MATCH\_GID Do we require users that want to access GNS to be in the 'gnunet' group? Default value: NO ## EXAMPLES This example is a simple way to get started, using a server that has a known list of peers to get you started. Most users will be behind a firewall on IPv4, as such NAT is enabled. Please remember to change your IP address to the actual external address for your usage. ``` [hostlist] OPTIONS = -b -e [nat] BEHIND_NAT = YES ENABLE_UPNP = YES DISABLEV6 = YES EXTERNAL_ADDRESS = 157.166.249.10 [arm] START_SYSTEM_SERVICES = YES START_USER_SERVICES = NO ``` ## FILES *~gnunet/.config/gnunet.conf* GNUnet system-user configuration file *$HOME/.config/gnunet.conf* User specific GNUnet configuration file */etc/gnunet.conf* Systemwide GNUnet configuration file *$GNUNET\_PREFIX/share/gnunet/config.d/* GNUnet configuration directory with all default option values ## SEE ALSO [env(1)](/env/1.md), [gnunet-arm(1)](/gnunet-arm/1.md), [gnunet-setup(1)](/gnunet-setup/1.md), [strftime(3)](/strftime/3.md). The full documentation for gnunet is maintained as a Texinfo manual. If the [info(1)](/info/1.md) and gnunet programs are properly installed at your site, the command ``` info gnunet ``` should give you access to the complete handbook, ``` info gnunet-c-tutorial ``` will give you access to a tutorial for developers. Depending on your installation, this information is also available in gnunet(7) and gnunet-c-tutorial(7). ## BUGS Report bugs by using **https://bugs.gnunet.org** or by sending electronic mail to ⟨*gnunet-developers@gnu.org*⟩.